Apache-2.0: the advisory reviewer has no reason to be restricted - #22
Merged
Conversation
Signetry moves to an open-core model. This repository is part of the integration surface, so it is now Apache-2.0: use it, fork it, ship it commercially, no permission needed. The engine (Signetry/core) is source-available under BUSL-1.1 and converts to Apache-2.0 on 2030-08-31. Until now this repo was "All Rights Reserved" with no LICENSE file, which GitHub reports as no license at all — the strictest possible default. It blocks corporate evaluation outright and makes outside contribution legally murky. That is a particularly bad fit here: the reviewer is advisory by construction, it never merges and never gates, so there is no part of it worth restricting. LICENSING.md in the umbrella repo promises that every public Signetry repository is covered by its licence table and that a public repo with no LICENSE file is a bug. This repo was one of four making that false. What changed: - LICENSE (Apache-2.0) added, so GitHub detects and displays it. - pyproject.toml declares Apache-2.0 and the OSI Apache classifier, replacing "Proprietary — All Rights Reserved". - README, CONTRIBUTING, CLA, CONTRIBUTORS, action.yml, the release workflow's notes and the CLA bot comment no longer claim the project is "not open source" or withhold usage rights. CONTRIBUTING gained the development, lint/test and new-check sections it was missing, and states the one rule this repo will not bend: the reviewer stays advisory. - CONTRIBUTORS' "credit, not ownership" paragraph said being listed grants no right to use or commercialize the project. Under Apache-2.0 everyone already has those rights, so it now scopes the disclaimer to what it can actually mean: no ownership, no presenting the project as your own, no using the Signetry name to endorse your own products. - The CLA is kept, because open core means code moves across the licence line and relicensing needs those rights. Its fallback grant is now non-exclusive: the previous *exclusive* grant would have stripped contributors of the right to use their own contribution, contradicting the rights the LICENSE grants everyone. The text is now byte-identical to the other Signetry repos' so the terms cannot drift per-repo again. No functional or API change. 37 tests pass, ruff clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Signetry/reviewerhad noLICENSEfile.LICENSING.mdsays: "If you find a public Signetry repository with noLICENSEfile, that is a bug — please open an issue." This is that bug, fixed.Apache-2.0, not source-available
The reviewer is advisory by construction — it never merges and never gates. Gating is
signetry-action's job. There is no reason to restrict who may run an advisory tool, so this repo goes fully Apache-2.0 along with the rest of the integration surface.LICENSE— Apache-2.0, © 2026 Binay DalaiCLA.md— the canonical org CLA (byte-identical toeval's; verified repo-agnostic)README.md— the rights-reserved blockquote and the[![Source-available]]badge are gonepyproject.toml—license = { text = "Apache-2.0" }+ the OSI Apache classifieraction.yml,.github/workflows/release.yml,.github/workflows/cla.yml— licence strings in metadata and in the CLA bot's commentThe correction that matters most
CONTRIBUTORS.mdclaimed contributors "gain no ownership or right to use/sell it". Under Apache-2.0 that is flatly untrue, and it would have deterred exactly the people this repo wants. It now reads:The CLA still applies, and
CONTRIBUTING.mdnow explains why rather than just asserting it: because Signetry is open core, code legitimately moves across the licence line, and the CLA is what lets it move without tracking down every past contributor.Also
CONTRIBUTING.mdwas a 25-line "Contribution Agreement" with no dev setup. It is now a real contributor guide — install, lint, test, how to add a deterministic check — ending with the one rule this repo will not bend: the reviewer stays advisory. A PR that makes it merge or gate belongs inaction.Verification
37 tests pass,ruff check signetry_reviewer/ tests/→ All checks passed!Every cross-repo link here points at
LICENSING.mdandcore/LICENSE, neither of which exists onmainyet — they land inSignetry/signetry#31andSignetry/core#107. The 12 relicense PRs are one atomic change; mergesignetry#31andcore#107first or those links 404.